Meet 402xAgent: Ask Before Your Agent Pays

Your agent finds an x402 endpoint listed at a tenth of a cent. It calls, gets a 402 and signs. Nobody checks whether that 402 still names the wallet, network and price on the listing.

That last-second gap is the one we work on.

Who we are

We're a small team building agent-commerce tools for x402 and MCP. 402xAgent is the first one most builders will touch. It's a check your agent runs right before it pays.

We'll keep this short. No team photos, no customer logos. Here's what the thing does.

What it's for

Our homepage says it in one line: 402xAgent "stops your agent paying dead, mispriced or wrong-network endpoints, or the wrong token or payee."

That's the whole job. We haven't published a grander mission statement, and we won't make one up for a blog post. Our goal is narrow: when your agent is about to sign a USDC payment, it should know the terms are the ones it expected.

One principle shapes everything else. From our pricing page: "Payment buys access only; it never changes a verdict." Free, paid and dry-run checks run the same rules.

How it works: probe, compare, decide

1. Probe. We send one unpaid, SSRF-safe request to the endpoint. We never pay the target.
2. Compare. We set the live 402 against the listing on four fields: payTo, network, token (canonical USDC) and price.
3. Decide. We return pay with the exact terms to sign, skip with a reason code, or recheck when there's no decision yet (a timeout or a 5xx, say).

Here's a real call against the live API. It's a dry run, so nothing is signed or paid:

curl "https://api.402xagent.com/v1/products/endpoint-spot-check?url=https://api.402rates.com/v1/ping&mode=dry-run"

{
  "verdict": "pay",
  "reason": "listed $0.001, payment request matches the listed price",
  "reason_code": "price_ok",
  "confidence": "high",
  "receipt_url": "https://402xagent.com/v1/receipts/sc-062b34654a87d179",
  "history": { "observations": 27, "stable_for_days": 2, "drift": false },
  "reputation": { "host": "api.402rates.com", "band": "high" }
}

Trimmed response, fetched 2026-10-16 ~08:02 PT. The endpoint shown is our own public demo example.

Drop &mode=dry-run and you get a live check. A paid check adds the payment object to sign: network, USDC contract, amount, payTo and deadline.

Every rule behind a verdict is public at /rules (JSON at /rules.json). Each skip maps to a code there, such as pay_to_mismatch, network_mismatch or price_mismatch.

Receipts you can verify without trusting us

Every check leaves a receipt. New receipts are signed with ed25519 over the canonical JSON of the receipt. The public keys are at /.well-known/402xagent-keys.json, and /docs#receipt-signatures walks through verifying one offline in a dozen lines of Node. If you use x402-spotcheck, verifyReceipt(receipt) does it in one call.

A valid signature proves we issued the receipt. It doesn't make the verdict right. That's what the published rules are for.

The public data

You don't need to call us to see what we see:

• /v1/skips.json: the weekly crawl of public x402 lists and every skip, with its reason.
• /saves: the last 30 days of cases where the live 402 asked more, paid a different wallet or used another network than listed. Wallets are never printed.
• /bazaar: our daily check of the top Coinbase CDP Bazaar search results.
• /reputation/<host>: a coarse band (high, medium, low or insufficient data) for any host, free.

Two numbers from the latest crawl (dated 2026-10-13): 121,785 unpaid checks, and 32,084 of them ended in a skip. That's roughly one check in four. Most skips were dead URLs or missing paywalls. A few hundred were wrong-wallet or wrong-network cases, and those are the ones that cost real money. Our next post breaks the skips down by failure type.

Where it runs, and what it costs

Payments are USDC on Base today. The live site makes no promise about other networks for the service, so we won't either.

Pricing, as shown on /pricing:

• Free: 5 checks a day.
• Paid check: a flat $0.02 USDC per check on Base, whatever the target charges.

No account and no API key.

If you'd rather not call us by hand, x402-spotcheck wraps @x402/fetch or @x402/axios in one line. A skip blocks the payment. Anything else, including a timeout, lets it through unless you configure it to block.

Try one

Pick an endpoint your agent already pays. Run the free check above against it and read the reason. If it says pay, good. If it says skip, you just found out cheaply.

— the 402xAgent team / withgrokbot